An organization is designing a redundant external service solution for their DNS and NTP servers. They need to ensure that if the primary DNS or NTP server becomes unavailable, the Palo Alto Networks firewall automatically switches to a secondary server without manual intervention. Which configuration on the Palo Alto Networks firewall enables this automatic failover for external services?
- ADefining a Server Profile (DNS Proxy or NTP Server Profile) with multiple server addresses and a health check.
- BConfiguring a single DNS proxy profile with multiple DNS servers.
- CEnabling redundant interfaces for the DNS and NTP servers.
- DSetting up a custom application for DNS and NTP traffic with a failover group.
Show answer & explanationAnswer & explanation
Correct answer: A. Defining a Server Profile (DNS Proxy or NTP Server Profile) with multiple server addresses and a health check.
To achieve automatic failover for external DNS and NTP services, the Palo Alto Networks firewall requires a Server Profile (either a DNS Proxy Profile or an NTP Server Profile). Within these profiles, multiple server addresses can be listed, and a health check mechanism is configured to monitor their availability, enabling the firewall to automatically switch to an available server upon failure.
Why the other options are wrong
- B. While a DNS proxy profile can list multiple DNS servers, it typically round-robins them rather than performing an active health check and failover without an explicit health check configuration within a server profile.
- C. Enabling redundant interfaces on the firewall is for firewall HA, not for monitoring and failing over external DNS or NTP servers.
- D. Creating a custom application does not provide a mechanism for automatic failover of the external services themselves; it's for identifying and controlling traffic.
External Service Redundancy (Palo Alto Networks)
Palo Alto Networks firewalls achieve redundancy for external services like DNS and NTP by configuring Server Profiles that include multiple server addresses and health monitoring to enable automatic failover.
- Uses DNS Proxy Profile for DNS.
- Uses NTP Server Profile for NTP.
- Requires multiple server addresses.
- Incorporates health checks for failover detection.
Memory trick: External services need 'PROFILES' with 'MANY' servers and 'HEALTH' checks.